CVE-2026-120755: Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter
Vulnerability summary
CVE-2026-120755 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in hdfgroup hdf5.
Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 03-11-2026PublishedVulnerability first disclosed.
- 03-11-2026Last modifiedVulnerability information updated.
Description
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.7MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Hdfgroup1 product
- hdf5≤ 2.2.0
The hdf group1 product
- szip filter< 2.3.0
2 vendors · 2 products